TaoSecurity Blog

Did you know you can watch live TV via satellite feeds from across the globe? The quality isn't that great, but it's cool to see what's available. Visit LyngSat , which has lots of annoying ads balanced by free TV signals.

I'm frequently asked what's the best way to protect home users from Internet-based external attacks. I'm a big fan of the NR041 , a SOHO cable/DSL router built by Network Everywhere . The style of their devices is similar to older Netgear products, but it appears to belong to Linksys , now a subset of Cisco. Best Buy appears to sell the product for $49.99, but I bought mine for much cheaper at Buy.com . I take my NR041 on the road and "hide" behind its NAT on client networks.

If you're looking to add USB 2.0 and Firewire connectivity to your laptop, consider this OrangeCombo PC Card . I don't own one (yet) because I have a USB 2.0 adapter for my laptop, but not any Firewire devices. This is a great way to make use of external storage, either for backup or forensic purposes.

Look at the Amazon.com home page -- here's what I saw when I checked in a few minutes ago. This is either a defacement or an upgrade gone horribly wrong! At top is the "view source" and at bottom is what it looks like in my browser. Ok, I just checked it again. It's back to normal. How weird is that? Has anyone else seen this sort of thing before? Was it a load balancer gone bad?

While researching for my new book The Tao of Network Security Monitoring , I wanted to read articles published in scholarly journals and other academic forums. I found the CiteSeer Scientific Literature Digital Library to be extremely valuable. You can query by keywords or browse collections like Intrusion Detection by date. When you come across a paper with lots of citations, like Intrusion Detection: A Bibliography , they are usually linked. The University of California at Davis offers a Computer Security Archives Project where older but useful papers are kept. I found Todd Heberlein 's site archives all of his papers , including those on network security monitoring. Honeypots.net , not part of the Honeynet Project , contains lots of references. Citeseer event mentions a paper I wrote .

I've kept the link to Prelude-IDS in my bookmarks for several weeks now. Just recently I saw an article at O'Reilly's ONLamp.com discussing it. Prelude looks especially interesting as it is a hybrid IDS, offering both host and network components. There seems to be lots of documentation and Prelude can be found in the FreeBSD ports tree. I'll report back when I try it out. Be warned -- the Prelude Web server seems unusually slow.

My friend John Curry has released Security Analyst Network Connection Profiler , which collects network session data. The Snort project also released Flexible Response Version 2 and Snort 2.0.2 within the last two weeks. While not new, dd_rescue is an enhancement of the standard 'dd' tool. While not open source, Microsoft offers a port scanner called portqry.exe .